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Reliability considerations associated with multiple-spot-beam sat- 
ellite systems are explored. If each coverage area is serviced by a single 
transponder, then loss of transponders due to failure eliminates all 
service to the areas covered by those transponders. Thus, failures are 
quite costly compared to a system employing global coverage with 
multiple transponders, where a limited number of transponder failures 
results in a slight increase in the traffic demand upon the survivors. 
Since the total orbital weight of a satellite is fixed, any redundant 
hardware deployed to improve reliability reduces the number of active 
transponders that can be supported, and a highly efficient redundancy 
strategy must be employed. Cold standby redundancy with complete 
spare interconnectivity is studied and appropriate reliability formulas 
are derived. A specific satellite concept dominated by final power 
amplifier failures is studied in detail, and it is found, for typical failure 
rates, that a 27-percent reduction in capacity must be accepted to 
provide for a single satellite lifetime reliability of 99 percent. Various 
techniques for employing the in-orbit redundancy of a spare satellite 
are investigated to increase reliability while minimizing capacity re- 
duction. Bounds are derived and a reliability of at least 99 percent is 
shown possible for a system containing three active satellites plus one 
spare, at a cost of 9 percent in potential capacity of the active satel- 
lites. 

I. INTRODUCTION 

Multiple-spot-beam antennas for communication satellites offer the 
potential for greatly increasing the traffic capacity of the satellite since 
the allocated frequency band can be reused in the various spot beams. 1_4 
In such a configuration, we might reduce the number of required satellite 
transponders by allocating a single wideband transponder, consisting 
of a receiver and a transmitter, to each antenna port as shown in Fig. 1. 
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Fig. 1 — Satellite transponder. 



An on-board switch is provided to route messages originating within the 
coverage area of one antenna beam to their destinations in the coverage 
areas of other beams. Access to the satellite is by time division multiple 
access (TDM A), and the up and down link frequency bands are the same 
for all beams. This arrangement is often referred to as satellite-switched 
TDMA. 

If each coverage area is serviced by a single transponder, failure of that 
transponder eliminates all communications to that area. Thus, reliability 
requirements are generally much higher than in earlier satellite systems 
employing frequency-division multiple access global beam coverage 
wherein failure of a single transponder results in partially reduced traffic 
handling capability to all users. 5 ' 6 

The higher reliability requirement of multiple-spot-beam satellite 
systems implies that either (i) additional redundant hardware must be 
provided and/or («) a more efficient strategy be adopted for deploying 
existing redundant units. Since the total orbital weight of the satellite 
is fixed by launch vehicle capability, it is desirable to maintain the weight 
of redundancy-related equipment at a minimum in order that as much 
weight as possible be available for active communication transponders. 
In this paper, several configurations employing cold standby redun- 
dancy 7-10 are proposed and explored, and additional weight vs reliability 
trade-offs are established. Consideration is limited to failures of the final 
high power traveling wave tube amplifiers (TWTAs) since the relatively 
high failure rate and large weight of these devices would dominate in a 
more detailed study. Exact results are provided for single satellite sys- 
tems; from these, reliability bounds for multiple satellite systems, in- 
cluding an in-orbit spare, are derived for a variety of philosophies for 
spare satellite utilization. 
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In Section II, the mathematical formulas pertaining to single satellite 
reliability employing cold standby M-on-N redundancy (M standby 
spare units for N active units with full interconnectivity) are derived 
assuming that the cold failure rate is zero. From these, we can find, at 
each point in time, the probability that j transponders have failed, ^ 
j ^N. 

These formulas are applied in Section III to a specific satellite concept, 
appropriate for a Thor-Delta launch, to determine transponder reli- 
ability vs capacity trade-offs under a weight constraint. Also investigated 
in Section III is the interconnectivity trade-off; that is, reliability vs total 
capacity for conditions other than full interconnectivity. 

In Section IV, upper and lower reliability bounds are derived for 
satellite systems containing an arbitrary number of active satellites plus 
an identical in-orbit spare. Various approaches to spare satellite utili- 
zation, differing in degree of complexity, are explored. Results indicate 
that significant reliability improvements can be achieved through ap- 
propriate utilization of the spare satellite. These results, however, are 
to be interpreted as indicative of a trend rather than as concrete design 
tools since the probability of catastrophic failure of an active satellite, 
requiring complete utilization of the spare satellite, was assumed to be 
zero in deriving the results. 

II. RELIABILITY FORMULAS 

In this section, a model for predicting the reliability of a multibeam 
communication satellite employing M-on-N standby redundancy is 
developed and analyzed. Complete interconnectivity is assumed, that 
is, any of the M cold standby redundant units may be substituted for 
any of the N active units upon failure of one of the latter. The cold 
standby failure rate is assumed to be zero, as is the failure rate of the 
interconnecting redundancy switches, and the failure rate for each active 
unit, X, is assumed to be constant. Failures are assumed to be charac- 
terized by a Poisson point process. An expression for the probability that 
N units are operational at any point in time is easily established; 11 this 
result is extended to find the probability of having ;' active channels as 
a function of time, ^ j ' ^ N. 

Let the system state j be the number of operational units at time t, 
^ j ' ^ N + M, and let Pj(t) be the probability of finding the system in 
state; at time t. Then, since there are N active units for states j - N,N 
+ 1, . . . , N + M, the following relationships hold for those states: 

P N+M (t + At) at (1 - NXAt)P N+M (t), (1) 

Pj(t + At) a (1 - NXAt)Pj(t) + NXAtPj+dt), N zj < N + M, (2) 
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where the approximations become exact as At -*■ 0. Similarly, since 
there are j active units for states j = 0, 1, . . . , N, 

Pj(t + At) s (1 -j\At)Pj(t) + (/+ l)\AtP j+ i(t), S7 <N. (3) 

Letting At -»• 0, the following set of differential equations results for the 
system state probabilities: 

<^- = -NXP N+M . (4) 

dt 

^ = -NXPj + N\Pi+ h N zj<N + M. (5) 

dt 

^i = -j\Pj +{j+ l)\P j+l , O^j <N. (6) 

dt 

Initial conditions are: 

P N+M (0) = 1. (7) 

Pj(0) = 0,0 ^j <N + M. (8) 

Solutions of these equations are readily obtained for N ^ j : ^ N + M. 
The solutions are: 

J (N + M-j)l 

Solutions for ^ ; < N are considerably more difficult and are derived 
in the Appendix. 

The exact solutions are rather cumbersome, provide little physical 
insight into the benefits of standby redundancy, and require high pre- 
cision arithmetic to obtain numerical results. Approximate formulas are 
therefore derived in the Appendix, valid for the region of interest {N - 
j)\t/(M + 3) « 1. Letting Qj be the probability of exactly ;' surviving 
operational transponders, we obtain: 

o - N ± M p ^_r M+2 i ^> m+ V na, (10) 



r M 2 + 5M+6 + A£ "1 [ (N\t) M+l e- Nx n 
Qn-i - Pn-M) ^ I _ j [ 1} , J- 



M 2 + 5M + 6 + A£ 1 [(NXt) M+l e- Nxt 
(M+2)(M+3-Xt). 

(11) 

^ „, x N\N M (M + 3)H\t) M+ N -Je- Nxt n . .. _ 

q. = p.(M = — — — — < / < AT - 2. 

* J J jl(N - j - 1)\(M + 2)\(M + 3 - \t) N ~J 

(12) 
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III. SATELLITE TRANSPONDER WEIGHT AND RELIABILITY 

We will now study the reliability vs weight trade-off for a particular 
satellite concept, appropriate for a Thor-Delta launch weight class. The 
following assumptions are made: 

(i) The satellite can support the weight of 11 transponders without 
any traveling wave tube redundancy. (Normalized weight = 
11). 
(ii) The weight of a traveling wave tube amplifier (including power 
supply) is equal to one-third the weight of a single transponder 
(including the weight of prime power sources for that tran- 
sponder). 

(Hi) Each switch point needed for redundancy has a weight equal to 
1/1 5th the weight of a traveling wave tube amplifier. 

These assumptions are consistent with weight and power budget re- 
quirements of a system described elsewhere. 12 

From these requirements, we see that the following redundancy ar- 
rangements are possible: 

(A) 10 active transponders 
2 standby TWTAs 

Complete redundant interconnectivity 
(Normalized weight = 10.9) 

(B) 9 active transponders 
4 standby TWTAs 

Complete redundant interconnectivity 
(Normalized weight = 10.7) 

(C) 8 active transponders 
6 standby TWTAs 

Complete redundant interconnectivity 
(Normalized weight = 10.5) 

(D) 9 active transponders 
6 standby TWTAs 

Redundancy provided in 2 on 3 arrangement 
(Normalized weight = 11.2) 

Numerical results have been obtained for TWTA failure rates between 
1500 and 6000 fits (one fit is a failure rate of 1 per 10 9 hours). These ex- 
tremes are based upon (/) actual space experience and life test data for 
space qualified TWTAs, (ii) changes in TWT electrical design objectives 
such as power rating, operating frequency, and multi-mode capability, 
and (Hi) projections for future technology improvements. 

Shown in Fig. 2 are the reliability predictions vs time for an 11 -tran- 
sponder satellite with no redundancy. Results are plotted for a failure 

COMMUNICATION SATELLITES 579 



si; 0.01 - 



0.001 




X = 6000 FITS 
X = 3000 FITS 



TIME IN YEARS 



Fig. 2— Active transponder probabilities for a satellite with 11 active transponders and 
no spare TWTAs. Qj is the probability that exactly J transponders are operational at time 
t.OfiJsll. 



rate of 6000 fits. Since the reliability predictions are dependent upon 
the product, Xt, predictions can easily be inferred for other failure rates 
by scaling the time axis by the ratio of 6000/X, X being the failure rate 
under consideration. Such a scaling has been performed in Fig. 2 for X 
= 3000 fits. 

Results for Cases A-D are shown, respectively, in Figs. 3 through 6. 
Since Case D employs less than full redundant interconnectivity, we solve 
equations (4) through (8) for N = 3, M = 2, and use these to calculate 
the desired probabilities: 



Qq = P{3 active transponders in each of 3 groups) 
= (Q 3 ') 3 . 



(13) 



Q 8 = P(3 active transponders in each of 2 groups and 
2 active transponders in the third group} 

= 3(Q 3 , ) 2 Q 2 / . 
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Fig. 3— Active transponder probabilities for a satellite with 10 active transponders and 
2 spare TWTAs. Each transponder can access any spare amplifier. Qj is the probability 
that exactly J transponders are operational at time t,0 sj s 10. 

Qi = P\3 active transponders in each of 2 groups 
and 1 active transponder in the third, or 2 
active transponders in each of 2 groups and 
3 active transponders in the third) 

= 3(Q 3 ') 2 Qi' + 3(Q 2 , ) 2 Q 3 ', etc. (15) 

Figures (2) through (6) represent a mesh of the exact solutions of the 
Appendix and the approximate solutions (10) through (12); that is, for 
large t, the exact expressions have been plotted, while, for small t, the 
approximate solutions are used since they provide better accuracy than 
possible via numerical evaluation of the exact solutions. In all cases, 
agreement was better than 5 percent at the cross-over point between the 
exact and approximate solutions. 

We now interpret the results appearing in Fig. (2) through (6). A 
seven-year satellite life is assumed. We see from Fig. 2 that service is 
quite unreliable in the absence of redundancy. For a TWTA failure rate 
of 6000 fits, the probability of providing service to all coverage areas is 
less than 2 percent at the end of satellite life; this figure rises to about 
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Fig. 4— Active transponder probabilities for a satellite with 9 active transponders and 
4 spare TWTAs. Each transponder can access any spare amplifier. Qj is the probability 
that exactly J transponders are operational at time t, s J £ 9. 
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Fig. 5— Active transponder probabilities for a satellite with 8 active transponders and 
6 spare TWTAs. Each transponder can access any spare amplifier. Q.j is the probability 
that exactly J transponders are operational at time t, s J ^ 8. 
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Fig. 6— Active transponder probabilities for a satellite with 9 active transponders and 
6 spare TWTAs. Each transponder within a group of 3 can access only the two spare am- 
plifiers assigned to that group. Q./ is the probability that exactly J transponders are op- 
erational at time (,0sJs9. 



13 percent for a failure rate of 3000 fits and to 36 percent for X = 1500 
fits. In fact, the probability of providing service to seven or fewer of the 
original 11 overage areas is 41 percent for X = 3000 fits. Performance is 
unacceptable for a satellite system employing multiple spot beams, and 
this case will not receive any further attention. 

The expected number of surviving transponders for Cases A through 
D are plotted in Fig. 7 as functions of time. From these curves we con- 
clude that Case A (10 active transponders, 2 spares, full interconnecti- 
vity) provides the maximum number of expected transponder years. 
From Fig. 3, we see that for this case, the probability of losing at least 
one transponder by satellite end-of-life is 72 percent for X = 6000 fits, 
26 percent for X = 3000 fits, and 6 percent for X = 1500 fits. However, the 
probability of having seven or more active transponders at satellite 
end-of-life is 88 percent for X = 6000 fits, 99 percent for X = 3000 fits, 
and 99.99 percent for X = 1500 fits. Thus, such an arrangement is prob- 
ably unacceptable for multiple spot-beam satellites, but is a prime 
candidate for a global coverage satellite since it provides maximum ex- 
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Fig. 7— Expected number of active transponders vs time. Cases A, B, C, and D are as 
defined in the text. 

pected transponder years with high probability of providing at least 
70-percent throughput at satellite end-of-life. 

For a multiple spot-beam satellite, we see that Case C provides the 
most dependable service, but that the expected number of transponder 
years is lower than that for Cases B or D. For Case B, we see that for X 
= 6000 fits, the probability of at least one transponder failing has risen 
to 24 percent by end of satellite life, and that the probability that no more 
than one transponder fails is only 88 percent. However, for X = 3000 fits, 
Case B provides for complete service with a 97-percent probability at 
end of satellite life; the probability that no more than one transponder 
fails is 99 percent. For X = 1500 fits, the corresponding probabilities are 
99,9 percent and 99.99 percent. Thus, for a TWTA failure rate of 1500 fits, 
Case B appears superior to Case C in that an additional transponder is 
provided with high probability over the life of the satellite. Conversely, 
for a high TWTA failure rate (6000 fits), Case C is to be preferred since 
it provides for more dependable service toward the satellite end-of- 
life. 

It is noted further that for a multiple spot-beam satellite, Case B is 
marginally preferable to Case D if the probability of providing complete 
service over the life of the satellite is to be maximized (97 percent vs 95 
percent for X = 3000 fits). Case D, however, provides for a smaller 
probability that more than one transponder fails (0.5 percent vs 1 per- 
cent). Since Case B requires twice the number of switch points to provide 
for complete interconnectivity, its marginal advantage might disappear 
if the switch reliability were to be included in the analysis. Conversely, 
Case D requires slightly more weight than Case B. Thus, for the partic- 
ular parameters selected for this study, Case B and D are virtually in- 
distinguishable; both provide for highly reliable service over the life of 
the satellite if the TWTA failure rate is sufficiently small. 

We conclude this section with a plot of satellite capacity vs end-of-life 
reliability for each case discussed (satellite weight constraint). Fig. 8a 
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Fig. 8— Probability of success after 7 years vs the original number of active transponders. 
Success is defined in one of three ways: no failures, no more than one failure, or no more 
than two failures, (a) A = .'WOO fits, (b) A = 6000 fits. 



is applicable for X = 3000 fits; Fig. 8b for X = 6000 fits. For these plots, 
reliability is defined as having no more than 0, 1, or 2 failed transpon- 
ders. 

IV. APPLICATION TO MULTI-SATELLITE SYSTEMS 

We now apply the results of Sections II and III to determine bounds 
on the success probability, P s , of a system containing S identical active 
satellites. Success is defined as having all design transponders (S X N 
total) available at end-of-life. All satellites are assumed to be launched 
simultaneously. 

Obviously, at any point in time, P s (t) = Qfi(t), where Qa/(0 is the 
probability of all transponders being active on any given satellite at time 
t . Results for the cases studied in Section III appear in Table I. 
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Table I — Satellite system success probability; unutilized in-orbit 

spare 



s 


Case A 


CaseB 


CaseC 


CaseD 








(a) A = 6000 fits 








2 

:\ 

■i 


0.08 
0.02 
0.01 


0.57 
0.44 
0.33 

(b) A = 3000 fits 


0.98 
0.97 
0.96 


0.52 
0.37 
0.27 




2 
3 
A 


0.54 
0.41 
0.30 


0.94 
0.91 
0.89 

(c) A = 1500 fits 


0.999 
0.999 
0.998 


0.90 
0.86 
0.81 




2 

:i 
4 


0.82 
0.74 

0.67 


0.996 
0.994 
0.992 


0.9999 
0.9999 
0.9999 


0.984 
0.976 
0.968 





From Table I, we conclude that, with the exception of Case C, the 
success probability is unacceptably low at the higher fit rates. For X = 
1500 fits, Case B is relatively attractive. 

Since, by any measure, the cost associated with total failure of one 
satellite of a satellite system is prohibitive, satellite systems generally 
contain an in-orbit spare. In the following, we explore the possibility of 
using this spare to improve reliability of systems containing S active 
satellites plus an identical spare. 

Suppose we use the spare satellite by assigning to it all the traffic of 
the first active satellite to experience a transponder failure. Upon such 
a failure, each ground station permanently reroutes all communications 
with the failed satellite to the spare. From eq. (9), the probability r(t)dt 
that any one of the active satellites loses its first transponder in [t, t + 
dt], given that the first loss occurs somewhere within [0, T], is: 

M! ' N\P N (t)dt ._. 

r(t)dt= = ( 16 > 

f N\ - ' ' dt NX \ P N (t)dt 

Jo ' M\ Jo 

The probability u that the spare satellite then successfully completes 
the mission of the failed active satellite is given by: 

u= C T r(t)Q N (T - t)dt, (17) 

where Qn is given by eq. (10). Since, for the mission to be successful, the 
remaining active satellites must be operational at end-of-life, and since 
the spare, if needed, can be assigned to any of S satellites, we obtain 
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Table II — Satellite system success probability. Spare satellite 
replaces first active to fail 



No. Active 
Satellites 


Case A 
X = 1500 fits 


Case A 
X = 3000 fits 


CaseB 
X = 3000 fits 


CaseB 
X = 6000 fits 


CaseC 
X = 6000 fits 


1 
2 
3 
4 


0.975 
0.938 
0.903 
0.866 


0.961 
0.872 
0.762 
0.621 


0.997 
0.993 
0.988 
0.983 


0.970 
0.883 
0.773 
0.659 


0.999 
0.996 
0.993 
0.989 



Ps = Qn + SNXuQfr 1 C T p N (t)dt. (18) 

The evaluation of eq. (17) is straightforward and is omitted. Evaluation 
of (18) for Cases A, B, and C of Section II yields the results appearing 
in Table II. 

By comparing these results against those of Table I, we see that the 
availability of the spare satellite has greatly enhanced the probability 
of mission success. However, for Case A, we again conclude that the 
success probabilities are too low for systems employing two or more ac- 
tive satellites. In what follows, we explore the advantages of deploying 
the spare satellite in a different manner. 

Suppose the spare satellite is used by assigning individual transpon- 
ders on the spare satellite, as needed, to replace failed transponders on 
the active satellites. Each ground station, then, must be capable of dy- 
namically routing that portion of its traffic destined for the coverage 
areas of the failed transponders to the spare satellite. Since, for this 
study, the spare satellite is identical to the active satellites, we conclude 
that the mission is successful if (i) the total number of failed transpon- 
ders on all active satellites is giV, (ii) no two transponders servicing the 
same footprint fail on the active satellites, and (Hi) the assigned tran- 
sponders on the spare satellite survive after activation for the remainder 
of the mission. From this, we derive upper and lower bounds on the 
probability of success as follows. 

Let Pi be the probability that i transponders have failed on an active 
satellite; i.e., p, = Q N -, •. Then, the number of ways, W, that i\ out of N 
transponders fail on active satellite 1, i 2 out of AT transponders (covering 
footprints different from the i x failed transponders of satellite 1) fail on 
satellite 2, . . . , and is out of N transponders (covering footprints dif- 
ferent from the i\ failed transponders of satellite 1 and the io failed 
transponders of satellite 2, etc.) fail on satellite S is given by: 

m N\ 

ii!i 2 ! . . . i s l(N - ij - i 2 - . . . - i s )\ • (19) 

COMMUNICATION SATELLITES 587 



where (>) represents the binomial coefficient k \/j\(k -;')! The total 
number of outcomes T in which ij transponders fail on the ; th satellite, 
1 ^ ; ^ S, is given by 

The probability of mission success is given by 



(20) 



P,. = £ P(s\i l ,...,is)Pi>Pi>--Pis (2D 



II, ■ • • ,IS 



Obviously, P(s\h, i 2 , ...,is) = 0, h + h + • • • + is > N, 

for then the spare satellite has too few transponders to provide complete 

coverage. 

Let us define B k as the probability that none of k specific transponders 
on the spare satellite have failed at mission end-of-life, given that all 
spare TWTAs on the spare satellite are available to these k transponders, 
and that the remaining N - k transponders on the spare satellite are 
unactivated. The k active transponders are activated at the beginning 
of the mission; the probabilities B k are obtained by solving eqs. (4) 
through (8) for N = k. 

Now, for a given set \ij \ 1 ^ ; ^ S\, all outcomes of failures are equally 
likely. Thus, assuming that the transponders on the spare satellite 
needed to take over for failed transponders are available and do not fail, 
we see that 

P(S|»! is)i^- *. (22) 

* ii is 

Similarly, by assuming that ii+i 2 + ... is transponders are initially 
activated on the spare satellite and that spare TWTAs are available only 
to these transponders, we see that 

P(S\i lt ..., is) > ^" is B n+t , + . . . -k, (23) 

■» i'i is 

Thus, 

(N - iM N - i 2 )\ ■ ■ ■ (N ~ isV- R 

,, £,, P '^ ■ ■ ■ Pi » W ) s -HN-i 1 -i 2 -...-is)r ii+h+ • • • +,s 

il+i>+ . . . +is^N 

(N - hY.jN - i 2 )\ . . . (N - is)\ ( . 
= P °= il Z , ls Pi ^--- Pis (N\)S-HN-i 1 -i 2 ...-is)\- m 

j'l+i 2 + . . . +ts*N 

We apply these bounds to Case A for X = 3000 fits and to Case B for 
A = 6000 fits. Results appear in Table III. We note that dynamic tran- 
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Table ill — Satellite system success probability. Spare satellite 
transponders assigned dynamically without priority 

No. Active Satellites Case A Case B 

1 0.998 s P„. s 1.0 0.999 ^ P, £ 1.0 

3 0.946 £ P s £ 0.951 0.951 ^ P s s 0.953 



sponder assignments on the spare satellite have raised the success 
probability for Cases A and B appreciably. 

Another redundancy strategy, applicable to improving the reliability 
of systems employing two or more active satellites, also evolves about 
dynamic assignment of the transponders of the spare satellite as re- 
quired. For this scheme, however, all available spare TWTAs on the active 
satellite are allocated on a priority basis such as to maximize the prob- 
ability of success. For example, if there are two active satellites and one 
has a single failed transponder whose traffic load has been assumed by 
the spare satellite, and the transponder covering the same footprint 
should fail on the second active satellite, then any available spare TWTAs 
on the second active satellite would be assigned to that failed tran- 
sponder; if such a spare had previously been brought on line to replace 
a different failed transponder, the spare satellite would then be employed 
to pick up the traffic of this second transponder. Again, each ground 
station must dynamically route that portion of its traffic destined for 
the coverage areas of the failed transponders to the spare satellite. 

The analysis of Section II is not directly applicable to this scheme. This 
analysis, however, can be applied to a slightly modified scheme whereby 
not only the spare TWTAs, but also those originally assigned to active 
transponders, are assigned, as needed, on a priority basis to maximize 
the probability of mission success. Then, the mission is successful, pro- 
vided that (i) no more than N transponders have failed on the active 
satellites, and (u) no needed transponders on the spare have failed. The 
probability of success, therefore, is upper-bounded by: 

Ps* £ p (| p,,...p,,. (25) 

'I. '12. - • • .IS 

M+ ... +isSN 

Assuming, as before, that ij + i 2 + . . . + is transponders needed on 
the spare satellite begin to fail at time t = and that all TWTAs on the 
spare satellite are available to these transponders, we obtain a lower 
bound as: 

Ps ^ £ Pi ,Ph ■ ■ ■ PisBi , + » 2 + . . . + is- (26) 

M is 

1 1 +(•_.+ . . . MsgN 
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We apply these results to a system containing three active satellites 
plus a spare. For Case A, with a failure rate of 3000 fits, the success 
probability exceeds 0.992, while for Case B, with a failure rate of 6000 
fits, the success probability exceeds 0.995. For both these examples, the 
upper bound given by eq. 25 is within 0.02 percent of unity. 

V. CONCLUSION 

The concept of satellite-switched TDMA was briefly reviewed, and the 
need for highly reliable transponders was discussed. Since, in a satel- 
lite-switched TDMA system, each coverage area is serviced by a single 
transponder, failure of that transponder eliminates service to that cov- 
erage area. 

Reliability formulas were derived for the probability of having; out 
of N active transponders operational, ^ j £ N, as a function of time 
for a system employing M-on-N cold standby redundancy. From these, 
approximate formulas, valid for highly reliable systems, were found. 
These results were then applied to study the reliability vs the number 
of transponder trade-off under a total transponder weight constraint. 
A specific concept, allowing 11 transponders with no redundancy, was 
studied. It was assumed that each transponder was equivalent in weight 
to two TWTAs plus interconnecting redundancy switches. Failure rate 
for the TWTA was varied between 1500 and 6000 fits. 

Results indicated that for X = 6000 fits, 6-on-8 redundancy with 
complete interconnectivity is required to achieve a success probability 
greater than 99 percent after seven years. Thus, for this case, reliability 
requirements result in a capacity reduction of 27 percent. For a lower 
failure rate of 3000 fits, 4-on-9 redundancy with complete interconnec- 
tivity would provide for 97.3-percent reliability; the capacity reduction 
is then 18 percent. For X = 1500 fits, 4-on-9 redundancy with complete 
interconnectivity would provide 99.8-percent reliability. 

Various schemes employing a spare satellite to increase the reliability 
of a system employing S active satellites were proposed and studied. 
Such a spare satellite is generally provided to protect against catastrophic 
failure; the probability of catastrophic failure was assumed to be zero. 
We saw that for a failure rate of 1500 fits, a reliability of 97.5 percent 
could be achieved for a single active satellite system employing 2-on-10 
complete interconnectivity redundancy; the spare was utilized by as- 
suming the entire burden of the active satellite when the first tran- 
sponder failure occurred. Similarly, a 99.7-percent reliability could be 
achieved for a 4-on-9 redundancy and a failure rate of 3000 fits. For the 
former case, reliability falls to under 95 percent when two or more active 
satellites are contained in the system. By contrast, a 6-on-8 strategy 
employing complete interconnectivity provides for reliability exceeding 
99 percent for X = 6000 fits and 3 active satellites. 
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To improve reliability of the 2-on-10 and 4-on-9 concepts at higher 
TWT failure rates, a different utilization of the spare satellite was ex- 
plored. This utilization consisted of dynamically assigning to the spare 
satellite only the traffic of failed transponders, rather than the entire 
traffic load of the first active satellite to lose a transponder. Such a 
scheme would require that each ground terminal be capable of com- 
municating, simultaneously, with all active satellites plus the spare. 
Then, for a TWTA failure rate of 3000 fits, a system employing a single 
active satellite with 2-on-10 redundancy plus an identical spare satellite 
would have a success probability exceeding 99.8 percent. Thus, high 
reliability is achieved at the expense of 9-percent traffic-handling re- 
duction of the active satellite potential. Under the same conditions, a 
system containing three active satellites plus a spare would have a success 
probability between 94.6 percent and 95.1 percent. 

To increase the reliability of multiple satellite systems still further, 
a concept again utilizing dynamic transponder allocation to the spare 
satellite was proposed. For this concept, however, the TWTAs of the ac- 
tive satellites were assigned among the active transponders on a priority 
basis to prevent failure when possible. It was then found that a system 
employing three active satellites plus a spare, each of 2-on-10 redun- 
dancy, would have a success probability exceeding 99.2 percent for a 
TWTA failure rate of 3000 fits; a 3-active plus spare satellite system, each 
of 4-on-9 redundancy, would have a success probability exceeding 99.5 
percent for a TWTA failure rate of 6000 fits. 

Thus, we conclude that for the type of satellite-switched TDMA 
system studied, we must accept a 27-percent reduction of capacity to 
achieve a 99-percent probability of losing no transponder if we do not 
utilize the presence of a spare satellite. If the spare satellite is properly 
employed, and if the probability of catastrophic failure is vanishingly 
small, we achieve even higher success probabilities at the expense of 9 
percent in traffic-handling capability. Since a greater volume of traffic 
can then be handled, and since the total traffic demand upon the satellite 
system grows with the number of service areas which can be intercon- 
nected at a rate greater than the traffic demand of individual additional 
areas, we conclude that utilization of the spare satellite, as proposed 
above, is highly desirable. 

APPENDIX 

In this appendix, we obtain exact solutions to eqs. (4) through (6), 
subject to initial conditions (7) and (8). Approximate solutions are also 
derived. For N ^ j ^ N + M, the exact solutions are: 

n , , {N\t) N+I "-Je-NM sr 

P ' (t) ~ (N + M-j)l ■ »***»*" »> 
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For s ; < N, we solve via Laplace transform techniques. From eq. 
(6), 



Thus, 



u±m£i±M . 

1 s + jX 



Pyv-i(s) = 

P N -2(S) = 



NXP N (s) 

s+(N- l)X 

N(N - l)X 2 P N (s] 



[s + (N - l)\][s + (N - 2)\] 



(27) 

(28) 
(29) 



From eq. (9), 



Thus, 



Pj(s) = 



N\X N ~J P N (s) 

/! N-j 

n [s + (n - k)\\ 

k=l 



Pn(s) = 



(NX) 



M 



(S + NX) M+l 



N\{NX) M X N ~J r 1 1 



(30) 



(31) 



x 



In' \s + (n - k)x\\ 



Ozj <N. (32) 



The various P/s are seen to possess a multiple pole of order M + 1 at s 
= -JVX and simple poles ats = -(N - k)X, k = 1, . . . ,N - j. All poles 
are in the left-half complex s-plane. We find Pj(t) by inverting a partial 
fraction expansion. The result is: 



Pj(t)ss ?L£L- e -Nxt E 



;! 



j= 1 Af-j 

/e=l 



X L /tb(Af-/)!l 



(33) 
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We now obtain approximate formulas for Pj(t), s j < N. Let 

/=o (M - 1)1 

- axty 






(M + 
For iXt/(M + 3) « 1, 



(iXt) M+i [ iXt 






axty 



/s (i^r 1 + ^ + 



(M 



j)Af+ir 

+ i)!L 



M+2 (M+3XM+2) 

axo 2 



+ . 



(34) 
(35) 
(36) 



M+2 (M+2MM+3) 



+ 



(iXt) 1 



(M+2)(M+3) 2 



+ . . . 



(37) 



(iXt) 



M+l |~ M+3 ] r 
l)!LM+2j L 



(M + 



(i\t) M +l [M+3 
(M + 



M+2 iXt 



M+3 M+3 



, (iXt) 2 (*A*) 3 



(M+3) 2 (M+3) 3 



+ . . . 



f+1 r M+3 "|r i 

1)!Lm+2JL M+3 + 



| iXt (iXt)* 

M+3 (M+3) 2 " 



(38) 



(39) 



(iXt) M +l [M+3 
(M + 



f+1 r M+3 1 

1)! LM+2J 



1 



1- 



iXt M+3 



Now, it is readily shown that 

1 



M+3 

(-l)N-j-i 



n-j (N - j - i)\(i - 1)\ 

n u-k) 



Thus, 

\I\NMp-N\t N-j 

Pj(t)*±^—r t £ 



(-l)N'J-i 



j\ if 1 (N - j - i)\(i - l)!i"+i 

1 



r qxt) M+ n r M + 3 1 

X L(M+ 1)U LM+2J 



1- 



iXt M + 3 



(40) 



(41) 



• (42) 



M+3 
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For \t/(M + 3) « 1, 



1- 



i\t 



M+3 



1- 



\t 



M+3- 



(43) 



Thus, 






1- 



\t 



M+3 



. (44) 



M+3 



Let 



S 



N J3 , v. /N-j\ 



l- 



x; 



(45) 



M+3 



Now, for any p\ 



il-P) N - j 



N-j /N - p 



■j- [(1 - 0)N-J] = -(N-j)(l - p)N-J-i 
dp 

N-j /N — 7\ 
= L -i ( ■ ) { -® 

1 n-j /N—i\ 
= I E ( . »•(-«■ 

P i=o V i I 



N-l //V — 7\ 

= E ( • ) <-# (46) 
(47) 



0= 



1- 



x* 



M+3- 



(48) 
(49) 

(50) 



Thus, 



A/ -i-l 



5=- 





1 J 


1- 

1 


xt 


M + 3-1 



(N-j) 



1- 



1- 



\t 



M+3' 



(51) 
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Now, 



N-j 



,/N-j 



E (-W ( . ) = 

«=1 \ l / |/3=1 



Thus, 



Pn-i(Os 



■ 



0, J '^ N - 2 



M 2 + 5M+6 + X£ 1 f(ATXO M+1 e- Nxt 



(52) 
(53) 

(54) 

(55) 
Finally, we obtain an approximate formula for the probability Q N that 
all N transponders are active at time t. We note that 



(M+2MM+3 



f \t I r (Arxtr +1 e-^n 

-\t)\\_ (M+l)! J 



N!iV M (M+3) 2 (XO A/+ ^->e- NXf 
7 =jl(N - ; - 1)!(M + 2)!(M + 3 - A£)"-> °= J = N ~ 2 - 



N+M 

Q N (t)= E P;(0 

j=N 

jt N (N + M-j)\ 

L a-m+1 /?! J 

For N\t/{M + 2) « 1, 

(N\t) M+1 



Q N (t) - e 



^, -NXt ) NXt _ 



(M + 1)! 



x r 1+ jvM. + _wxt)L + 

L M+2 (M+2) 2 



■••] 



(56) 
(57) 
(58) 



(59) 



s 1 - 



(N\t) M+l e~ Nxt 




1 


(M+ 1)! 


1- 


NXt 
M+2 



Thus, 



QNit) B x _ r M+2 I 

LM+2-NXiJ 



(NXO 



Af+l 
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M+2 -NX* J (M+ 1)! 



(60) 
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